/*
 * ObjectClassifier.h
 * NtTrace Analyzer
 * @author Gregoire JACOB (gregoire.jacob@orange-ftgroup.com)
 * @date 16/09/2008
 * @version 1.0
 */

//Constantes
#define RUN_REG1  	"Software\\Microsoft\\Windows\\CurrentVersion\\Run"
#define RUN_REG2	"Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
#define RUN_FILE1	"win.ini"
#define RUN_FILE2	"system.ini"
#define RUN_FILE3	"autoexec.bat"
#define RUN_FILER	"autorun.inf" //for amovible disk
#define RUN_FOLD	"Start Menu\\Programs\\Startup"
#define COM_DRIVE1	"\\Device\\Afd\\Endpoint"
#define COM_DRIVE2	"\\Device\\Tcp"
#define COM_DRIVE3	"\\Device\\Tcp6"
#define COM_DRIVE4	"\\Device\\Ip"
#define COM_DRIVE5	"\\Device\\NetBT_Tcpip"
#define COM_FILE	".MAPIMail"
#define COM_FOLD1	"Kazaa"
#define COM_FOLD2	"Edonkey"
#define COM_FOLD3	"Morpheus"
#define COM_FOLD4	"WinMX"
#define COM_FOLD5	"Bearshare"
#define COM_FOLD6	"Shared"
#define COM_FOLD7	"P2P"

char procname[NAME_MAX_LENGTH];
char fullprocname[NAME_MAX_LENGTH];
long procid;
long procaddress;


/**
 * ClassifyObject()
 * ClassifyFile()
 * ClassifyRegKey()
 * @param the object to classify
 * @param the address to classify if unnamed
 * @param the object nature (OBJ_FILE,OBJ_REG,OBJ_MAIL,VAR) (can be modified)
 * @param the returned object type (TYPE_VAR,TYPE_PERM,TYPE_BOOT,TYPE_COM,TYPE_THIS)
 */
void ClassifyObject(char * name, unsigned long address,
					int * type, int * nature);
void ClassifyFile(char * name, int * type, int * nature);
void ClassifyRegKey(char * name, int * type, int * nature);
//int classifyAdd(unsigned long address, int * type, int * nature);